Overview

overview

10

Static

static

ebuka.exe

windows7_x64

10

ebuka.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Payment Slip.rar

  • Size

    530KB

  • Sample

    210727-5ldv6xqxan

  • MD5

    ef2cd714ea2dcba7814ca37c5fb583f0

  • SHA1

    303b055e7d7fd4548cd69af352e56ebbfb6f0893

  • SHA256

    d2a9e5fd925d49872bb2412d446d162dd47673f1f94998589d1a663d28419e67

  • SHA512

    e7803ce23096b1b62ad86868043847543f19823fb0261803a762a584372fba588a8210f8c11373ed5009be8c15d0d5302af76c641f85586b6e462823262a2f96

Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.rgp.com.pk
  • Port:
    587
  • Username:
    pv@rgp.com.pk
  • Password:
    pvr999

Targets

    • Target

      ebuka.exe

    • Size

      669KB

    • MD5

      31d7c9de4d1b739ec63418eb198e84b3

    • SHA1

      78e6aec1a778e901f289369ddfd2144fe9d595df

    • SHA256

      93709182d579b433aa5f5fe1e4eeba4de3b5e497f78a5ef34d35bcd981f49f15

    • SHA512

      ecf9b902f9e77d827fac0ed31ad8b44003e9734c83cc3ea4ae397c9526528efc9b7497564fd02a1909a57ae64d10b603d15856cfb87911cba8d7b9ab78f026f5

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • CustAttr .NET packer

      Detects CustAttr .NET packer in memory.

    • Drops file in Drivers directory

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks